The present invention relates generally to wireless local area networks (WLANs) and more specifically to techniques for protecting a wireless network's infrastructure.
The IEEE (institute of Electrical and Electronic Engineers) 802.11 standard provides guidelines for allowing users to wirelessly connect to a network and access basic services provided therein. It has become more evident in recent years that security and controlled access are necessities in light of the large amount of sensitive information that is communicated over networks today.
Traditionally, the security and controlled access efforts have been directed toward protecting the data content of the transmission and not toward the prevention of session disruption. In other words, prior efforts have been directed toward protecting the sensitivity of the content of the data transmitted and not toward the protection of the transmission of management frame packets which control the session integrity and quality.
Of course, access to a network can be restricted by any number of methods, including user logins and passwords, network identification of a unique identification number embedded within the network interface card, call-back schemes for dial-up access, and others. These conventional protection schemes are directed toward controlling the overall access to the network services and toward protecting the data transmissions.
Unfortunately, identifying information contained within the management frames transmitted via a network (e.g. iEEE 802.11 network) has not been the focus of protection in traditional security schemes. U.S. patent application Ser. No. 10/687,075, filed on Oct. 16, 2003, the disclosure of which is hereby incorporated by reference herein, discloses a method for protecting the integrity of network management frames (for example 802.11 management frames) by providing message integrity checks and replay protection within a given security context. However, it does not provide a solution to the specific problem of establishment of the security context. This lack of protection leaves a network vulnerable to attacks whereby an attacker, such as a rogue access point, can spoof Access Point management frames. For example, a rogue access point (AP) can initiate an attack on one or more stations within a network by sending them a spoofed deauthenticate (DEAUTH) or disassociation request, at which point the client will politely disconnect from their original AP and begin to roam, sometimes roaming to the rogue AP which sent the spoofed request.